Graph convolutional anomaly detection

ABSTRACT

There is a need for more effective and efficient anomaly detection. This need can be addressed by, for example, solutions for performing/executing graph convolutional anomaly detection. In one example, a method includes identifying related graph database input data associated with a predictive entity; generating related graph feature data for the predictive entity; generating, based on the related graph feature data and using a graph convolutional neural network model, an anomaly detection score for the predictive entity, wherein at least a portion of the graph convolutional neural network model is trained using confirmation feedback data; performing an anomaly confirmation to generate the confirmation feedback data object for the predictive entity, and integrating the confirmation feedback data object for the predictive entity into the confirmation feedback data associated with the graph convolutional anomaly detection.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. Ser. No. 16/916,571 filedJun. 30, 2020, which is incorporated herein in its entirety byreference.

BACKGROUND

Various embodiments of the present invention address technicalchallenges related to performing anomaly detection. Various embodimentsof the present address the shortcomings of existing anomaly detectionsystems and disclose various techniques for efficiently and reliablyperforming anomaly detection.

BRIEF SUMMARY

In general, embodiments of the present invention provide methods,apparatus, systems, computing devices, computing entities, and/or thelike for performing/executing anomaly detection. Certain embodimentsutilize systems, methods, and computer program products thatperform/execute anomaly detection using one or more of graphconvolutional neural network models, anomaly confirmations, anomalyconfirmation feedback data, confirmation occurrence indicators, and/orconfirmation latency indicators.

In accordance with one aspect, a method is provided. In one embodiment,the method comprises generating, based at least in part on related graphdatabase input data, related graph feature data for a predictive entity,wherein the related graph feature data comprises a feature vector foreach related graph database object of one or more related graph databaseobjects associated with the predictive entity; generating, based atleast in part on the related graph feature data and using a graphconvolutional neural network model, an anomaly detection score for thepredictive entity, wherein at least a portion of the graph convolutionalneural network model is trained using confirmation feedback dataassociated with the graph convolutional anomaly detection; responsive toa determination to perform an anomaly confirmation with respect to thepredictive entity: performing the anomaly confirmation to generate theconfirmation feedback data object for the predictive entity, andintegrating the confirmation feedback data object for the predictiveentity into the confirmation feedback data associated with the graphconvolutional anomaly detection; and performing one or more responsiveactions based at least in part on the anomaly detection score.

In accordance with another aspect, a computer program product isprovided. The computer program product may comprise at least onecomputer-readable storage medium having computer-readable program codeportions stored therein, the computer-readable program code portionscomprising executable portions configured to generate, based at least inpart on related graph database input data, related graph feature datafor a predictive entity, wherein the related graph feature datacomprises a feature vector for each related graph database object of oneor more related graph database objects associated with the predictiveentity; generate, based at least in part on the related graph featuredata and using a graph convolutional neural network model, an anomalydetection score for the predictive entity, wherein at least a portion ofthe graph convolutional neural network model is trained usingconfirmation feedback data associated with the graph convolutionalanomaly detection; responsive to a determination to perform an anomalyconfirmation with respect to the predictive entity: perform the anomalyconfirmation to generate the confirmation feedback data object for thepredictive entity, and integrate the confirmation feedback data objectfor the predictive entity into the confirmation feedback data associatedwith the graph convolutional anomaly detection; and perform one or moreresponsive actions based at least in part on the anomaly detectionscore.

In accordance with yet another aspect, an apparatus comprising at leastone processor and at least one memory including computer program code isprovided. In one embodiment, the at least one memory and the computerprogram code may be configured to, with the processor, cause theapparatus to generate, based at least in part on related graph databaseinput data, related graph feature data for a predictive entity, whereinthe related graph feature data comprises a feature vector for eachrelated graph database object of one or more related graph databaseobjects associated with the predictive entity; generate, based at leastin part on the related graph feature data and using a graphconvolutional neural network model, an anomaly detection score for thepredictive entity, wherein at least a portion of the graph convolutionalneural network model is trained using confirmation feedback dataassociated with the graph convolutional anomaly detection; responsive toa determination to perform an anomaly confirmation with respect to thepredictive entity: perform the anomaly confirmation to generate theconfirmation feedback data object for the predictive entity, andintegrate the confirmation feedback data object for the predictiveentity into the confirmation feedback data associated with the graphconvolutional anomaly detection; and perform one or more responsiveactions based at least in part on the anomaly detection score.

BRIEF DESCRIPTION OF THE DRAWINGS

Having thus described the invention in general terms, reference will nowbe made to the accompanying drawings, which are not necessarily drawn toscale, and wherein:

FIG. 1 provides an exemplary overview of an architecture that can beused to practice embodiments of the present invention.

FIG. 2 provides an example graph convolutional neural network computingentity in accordance with some embodiments discussed herein.

FIG. 3 provides an example external computing entity in accordance withsome embodiments discussed herein.

FIG. 4 is a flowchart diagram of an example process for performing graphconvolutional anomaly detection in accordance with some embodimentsdiscussed herein.

FIG. 5 provides an operational example of a graph database in accordancewith some embodiments discussed herein.

FIG. 6 is a flowchart diagram of an example process for generating graphdatabase input data for a predictive entity in accordance with someembodiments discussed herein.

FIG. 7 provides an operational example of a graph database relatedsubset in accordance with some embodiments discussed herein.

FIG. 8 is a flowchart diagram of an example process for generating afeature vector for a related graph database object in accordance withsome embodiments discussed herein.

FIG. 9 provides an operational example of a concatenated graph featuredata object in accordance with some embodiments discussed herein.

FIG. 10 provides an operational example of a graph convolutional neuralnetwork in accordance with some embodiments discussed herein.

FIG. 11 is a flowchart diagram of an example process for generating ananomaly detection score in accordance with some embodiments discussedherein.

FIG. 12 is a data flow diagram of an example process for generating ananomaly detection score using a distributed database architecture inaccordance with some embodiments discussed herein.

FIG. 13 is a flowchart diagram of an example process for training agraph convolutional neural network using feedback confirmation data inaccordance with some embodiments discussed herein.

DETAILED DESCRIPTION

Various embodiments of the present invention now will be described morefully hereinafter with reference to the accompanying drawings, in whichsome, but not all embodiments of the inventions are shown. Indeed, theseinventions may be embodied in many different forms and should not beconstrued as limited to the embodiments set forth herein; rather, theseembodiments are provided so that this disclosure will satisfy applicablelegal requirements. The term “or” is used herein in both the alternativeand conjunctive sense, unless otherwise indicated. The terms“illustrative” and “exemplary” are used to be examples with noindication of quality level. Like numbers refer to like elementsthroughout. Moreover, while certain embodiments of the present inventionare described with reference to predictive data analysis, one ofordinary skill in the art will recognize that the disclosed concepts canbe used to perform other types of data analysis.

I. OVERVIEW

Various embodiments of the present invention address technicalchallenges related to performing real-time or near-real-time anomalydetection using graph input data. Graph input data provide a powerfulsource of predictive input data. As a result, recent machine learningmodels such as graph convolutional neural network models have attemptedwith varying degrees of success to utilize such graph input data toperform predictive inferences. However, because of structural complexityof graph-based databases, the existing solutions for graph-basedprocessing systems are inefficient and unreliable for real-time ornear-real-time predictive tasks such as various anomaly detection tasks.The resulting challenges have hampered the ability of developers toutilize vast amounts of graph-based data and recent advancements ingraph-based machine learning models to perform real-time ornear-real-time predictive tasks such as various anomaly detection tasks.

To address the noted challenges associated related to performingreal-time or near-real-time anomaly detection using graph input data.According to some aspects of the present invention, a graphconvolutional model used for anomaly detection is retrained usingconfirmation feedback data in order to enhance the real-time accuracyand dependability of the model without requiring expensive re-design andre-training operations that may require taking the model offline.

For example, in some embodiments, in response to determining to performthe anomaly confirmation with respect to the predictive entity, aproposed system performs the anomaly confirmation to generate theconfirmation feedback data object for the predictive entity, andintegrates the confirmation feedback data object for the predictiveentity into confirmation feedback data associated with a particulargraph convolutional anomaly detection task. In some other embodiments, aproposed system monitors a confirmation feedback stream to determine oneor more feedback properties of a confirmation feedback data object;determines, based at least in part on the one or more feedbackproperties, a confirmation score for an anomaly detection score;determines, based at least in part on the confirmation score, aground-truth anomaly designation for a predictive entity; and trains agraph convolutional neural network model based at least in part on theground-truth anomaly designation.

By utilizing the above-noted techniques, various embodiments of thepresent invention provide innovative techniques for improving real-timeor near-real-time application of graph-based machine learning modelssuch as graph convolutional neural networks. Moreover, by improvingreal-time or near-real-time application of graph-based machine learningmodels such as graph convolutional neural networks, various embodimentsof the present invention provide innovative techniques for performingreal-time or near-real-time anomaly detection using graph input data. Indoing so, various embodiments of the present invention make importanttechnical contributions to efficiency, effectiveness, and reliability ofboth graph-based machine learning models such as graph convolutionalneural networks and anomaly detection systems such as fraud detectionsystems.

II. COMPUTER PROGRAM PRODUCTS, METHODS, AND COMPUTING ENTITIES

Embodiments of the present invention may be implemented in various ways,including as computer program products that comprise articles ofmanufacture. Such computer program products may include one or moresoftware components including, for example, software objects, methods,data structures, or the like. A software component may be coded in anyof a variety of programming languages. An illustrative programminglanguage may be a lower-level programming language such as an assemblylanguage associated with a particular hardware architecture and/oroperating system platform. A software component comprising assemblylanguage instructions may require conversion into executable machinecode by an assembler prior to execution by the hardware architectureand/or platform. Another example programming language may be ahigher-level programming language that may be portable across multiplearchitectures. Examples of higher-level programming languages includeJava, C, C#, Python, and/or the like. A software component comprisinghigher-level programming language instructions may require conversion toan intermediate representation by an interpreter or a compiler prior toexecution.

Other examples of programming languages include, but are not limited to,a macro language, a shell or command language, a job control language, ascript language, a database query or search language, and/or a reportwriting language. In one or more example embodiments, a softwarecomponent comprising instructions in one of the foregoing examples ofprogramming languages may be executed directly by an operating system orother software component without having to be first transformed intoanother form. A software component may be stored as a file or other datastorage construct. Software components of a similar type or functionallyrelated may be stored together such as, for example, in a particulardirectory, folder, or library. Software components may be static (e.g.,pre-established or fixed) or dynamic (e.g., created or modified at thetime of execution).

A computer program product may include a non-transitorycomputer-readable storage medium storing applications, programs, programmodules, scripts, source code, program code, object code, byte code,compiled code, interpreted code, machine code, executable instructions,and/or the like (also referred to herein as executable instructions,instructions for execution, computer program products, program code,and/or similar terms used herein interchangeably). Such non-transitorycomputer-readable storage media include all computer-readable media(including volatile and non-volatile media).

In one embodiment, a non-volatile computer-readable storage medium mayinclude a floppy disk, flexible disk, hard disk, solid-state storage(SSS) (e.g., a solid state drive (SSD), solid state card (SSC), solidstate module (SSM), enterprise flash drive, magnetic tape, or any othernon-transitory magnetic medium, and/or the like. A non-volatilecomputer-readable storage medium may also include a punch card, papertape, optical mark sheet (or any other physical medium with patterns ofholes or other optically recognizable indicia), compact disc read onlymemory (CD-ROM), compact disc-rewritable (CD-RW), digital versatile disc(DVD), Blu-ray disc (BD), any other non-transitory optical medium,and/or the like. Such a non-volatile computer-readable storage mediummay also include read-only memory (ROM), programmable read-only memory(PROM), erasable programmable read-only memory (EPROM), electricallyerasable programmable read-only memory (EEPROM), flash memory (e.g.,Serial, NAND, NOR, and/or the like), multimedia memory cards (MMC),secure digital (SD) memory cards, SmartMedia cards, CompactFlash (CF)cards, Memory Sticks, and/or the like. Further, a non-volatilecomputer-readable storage medium may also include conductive-bridgingrandom access memory (CBRAM), phase-change random access memory (PRAM),ferroelectric random-access memory (FeRAM), non-volatile random-accessmemory (NVRAM), magnetoresistive random-access memory (MRAM), resistiverandom-access memory (RRAM), Silicon-Oxide-Nitride-Oxide-Silicon memory(SONOS), floating junction gate random access memory (FJG RAM),Millipede memory, racetrack memory, and/or the like.

In one embodiment, a volatile computer-readable storage medium mayinclude random access memory (RAM), dynamic random access memory (DRAM),static random access memory (SRAM), fast page mode dynamic random accessmemory (FPM DRAM), extended data-out dynamic random access memory (EDODRAM), synchronous dynamic random access memory (SDRAM), double datarate synchronous dynamic random access memory (DDR SDRAM), double datarate type two synchronous dynamic random access memory (DDR2 SDRAM),double data rate type three synchronous dynamic random access memory(DDR3 SDRAM), Rambus dynamic random access memory (RDRAM), TwinTransistor RAM (TTRAM), Thyristor RAM (T-RAM), Zero-capacitor (Z-RAM),Rambus in-line memory module (RIMM), dual in-line memory module (DIMM),single in-line memory module (SIMM), video random access memory (VRAM),cache memory (including various levels), flash memory, register memory,and/or the like. It will be appreciated that where embodiments aredescribed to use a computer-readable storage medium, other types ofcomputer-readable storage media may be substituted for or used inaddition to the computer-readable storage media described above.

As should be appreciated, various embodiments of the present inventionmay also be implemented as methods, apparatus, systems, computingdevices, computing entities, and/or the like. As such, embodiments ofthe present invention may take the form of an apparatus, system,computing device, computing entity, and/or the like executinginstructions stored on a computer-readable storage medium to performcertain steps or operations. Thus, embodiments of the present inventionmay also take the form of an entirely hardware embodiment, an entirelycomputer program product embodiment, and/or an embodiment that comprisescombination of computer program products and hardware performing certainsteps or operations. Embodiments of the present invention are describedbelow with reference to block diagrams and flowchart illustrations.Thus, it should be understood that each block of the block diagrams andflowchart illustrations may be implemented in the form of a computerprogram product, an entirely hardware embodiment, a combination ofhardware and computer program products, and/or apparatus, systems,computing devices, computing entities, and/or the like carrying outinstructions, operations, steps, and similar words used interchangeably(e.g., the executable instructions, instructions for execution, programcode, and/or the like) on a computer-readable storage medium forexecution. For example, retrieval, loading, and execution of code may beperformed sequentially such that one instruction is retrieved, loaded,and executed at a time. In some exemplary embodiments, retrieval,loading, and/or execution may be performed in parallel such thatmultiple instructions are retrieved, loaded, and/or executed together.Thus, such embodiments can produce specifically-configured machinesperforming the steps or operations specified in the block diagrams andflowchart illustrations. Accordingly, the block diagrams and flowchartillustrations support various combinations of embodiments for performingthe specified instructions, operations, or steps.

III. EXEMPLARY SYSTEM ARCHITECTURE

FIG. 1 is a schematic diagram of an example architecture 100 forperforming/executing anomaly detection. The architecture 100 includes ananomaly detection 101 configured to receive anomaly detection requestsfrom external computing entities 102, process the anomaly detectionrequests to generate anomaly detection outputs, provide the anomalydetection systems to the external computing entities 102, andautomatically perform anomaly resolution policies in response todetecting anomaly scenarios. An example of an anomaly detection task isa financial fraud detection task, a health insurance fraud detectiontask, and a medical insurance fraud detection task.

In some embodiments, anomaly detection system 101 may communicate withat least one of the external computing entities 102 using one or morecommunication networks. Examples of communication networks include anywired or wireless communication network including, for example, a wiredor wireless local area network (LAN), personal area network (PAN),metropolitan area network (MAN), wide area network (WAN), or the like,as well as any hardware, software and/or firmware required to implementit (such as, e.g., network routers, and/or the like).

The anomaly detection system 101 may include a graph convolutionalneural network computing entity 106 and a storage subsystem 108. Thegraph convolutional neural network computing entity 106 may beconfigured to receive anomaly detection requests from one or moreexternal computing entities 102, process the anomaly detection requeststo generate anomaly detection outputs, provide the anomaly detectionsystems to the external computing entities 102, and automaticallyperform anomaly resolution policies in response to detecting anomalyscenarios.

The storage subsystem 108 may be configured to store input data used bythe graph convolutional neural network computing entity 106 to performanomaly detection as well as model definition data used by the graphconvolutional neural network computing entity 106 to perform anomalydetection. The storage subsystem 108 may further be configured to storeconfiguration data associated with the anomaly detection system 101,such as configuration data associated with the graph-based databasesmaintained by the anomaly detection system 101 and/or configuration dataassociated with the operation of the graph convolutional neural networkcomputing entity 106.

The storage subsystem 108 may include one or more storage units, such asmultiple distributed storage units that are connected through a computernetwork. Each storage unit in the storage subsystem 108 may store atleast one of one or more data assets and/or one or more data about thecomputed properties of one or more data assets. Moreover, each storageunit in the storage subsystem 108 may include one or more non-volatilestorage or memory media including but not limited to hard disks, ROM,PROM, EPROM, EEPROM, flash memory, MMCs, SD memory cards, Memory Sticks,CBRAM, PRAM, FeRAM, NVRAM, MRAM, RRAM, SONOS, FJG RAM, Millipede memory,racetrack memory, and/or the like.

Exemplary Graph Convolutional Neural Network Computing Entity

FIG. 2 provides a schematic of a graph convolutional neural networkcomputing entity 106 according to one embodiment of the presentinvention. In general, the terms computing entity, computer, entity,device, system, and/or similar words used herein interchangeably mayrefer to, for example, one or more computers, computing entities,desktops, mobile phones, tablets, phablets, notebooks, laptops,distributed systems, kiosks, input terminals, servers or servernetworks, blades, gateways, switches, processing devices, processingentities, set-top boxes, relays, routers, network access points, basestations, the like, and/or any combination of devices or entitiesadapted to perform the functions, operations, and/or processes describedherein. Such functions, operations, and/or processes may include, forexample, transmitting, receiving, operating on, processing, displaying,storing, determining, creating/generating, monitoring, evaluating,comparing, and/or similar terms used herein interchangeably. In oneembodiment, these functions, operations, and/or processes can beperformed on data, content, information, and/or similar terms usedherein interchangeably.

As indicated, in one embodiment, the graph convolutional neural networkcomputing entity 106 may also include one or more communicationsinterfaces 220 for communicating with various computing entities, suchas by communicating data, content, information, and/or similar termsused herein interchangeably that can be transmitted, received, operatedon, processed, displayed, stored, and/or the like.

As shown in FIG. 2 , in one embodiment, the graph convolutional neuralnetwork computing entity 106 may include or be in communication with oneor more processing elements 205 (also referred to as processors,processing circuitry, and/or similar terms used herein interchangeably)that communicate with other elements within the graph convolutionalneural network computing entity 106 via a bus, for example. As will beunderstood, the processing element 205 may be embodied in a number ofdifferent ways. For example, the processing element 205 may be embodiedas one or more complex programmable logic devices (CPLDs),microprocessors, multi-core processors, coprocessing entities,application-specific instruction-set processors (ASIPs),microcontrollers, and/or controllers. Further, the processing element205 may be embodied as one or more other processing devices orcircuitry. The term circuitry may refer to an entirely hardwareembodiment or a combination of hardware and computer program products.Thus, the processing element 205 may be embodied as integrated circuits,application specific integrated circuits (ASICs), field programmablegate arrays (FPGAs), programmable logic arrays (PLAs), hardwareaccelerators, other circuitry, and/or the like. As will therefore beunderstood, the processing element 205 may be configured for aparticular use or configured to execute instructions stored in volatileor non-volatile media or otherwise accessible to the processing element205. As such, whether configured by hardware or computer programproducts, or by a combination thereof, the processing element 205 may becapable of performing steps or operations according to embodiments ofthe present invention when configured accordingly.

In one embodiment, the graph convolutional neural network computingentity 106 may further include or be in communication with non-volatilemedia (also referred to as non-volatile storage, memory, memory storage,memory circuitry and/or similar terms used herein interchangeably). Inone embodiment, the non-volatile storage or memory may include one ormore non-volatile storage or memory media 210, including but not limitedto hard disks, ROM, PROM, EPROM, EEPROM, flash memory, MMCs, SD memorycards, Memory Sticks, CBRAM, PRAM, FeRAM, NVRAM, MRAM, RRAM, SONOS, FJGRAM, Millipede memory, racetrack memory, and/or the like. As will berecognized, the non-volatile storage or memory media may storedatabases, database instances, database management systems, data,applications, programs, program modules, scripts, source code, objectcode, byte code, compiled code, interpreted code, machine code,executable instructions, and/or the like. The term database, databaseinstance, database management system, and/or similar terms used hereininterchangeably may refer to a collection of records or data that isstored in a computer-readable storage medium using one or more databasemodels, such as a hierarchical database model, network model, relationalmodel, entity-relationship model, object model, document model, semanticmodel, graph model, and/or the like.

In one embodiment, the graph convolutional neural network computingentity 106 may further include or be in communication with volatilemedia (also referred to as volatile storage, memory, memory storage,memory circuitry and/or similar terms used herein interchangeably). Inone embodiment, the volatile storage or memory may also include one ormore volatile storage or memory media 215, including but not limited toRAM, DRAM, SRAM, FPM DRAM, EDO DRAM, SDRAM, DDR SDRAM, DDR2 SDRAM, DDR3SDRAM, RDRAM, TTRAM, T-RAM, Z-RAM, RIMM, DIMM, SIMM, VRAM, cache memory,register memory, and/or the like. As will be recognized, the volatilestorage or memory media may be used to store at least portions of thedatabases, database instances, database management systems, data,applications, programs, program modules, scripts, source code, objectcode, byte code, compiled code, interpreted code, machine code,executable instructions, and/or the like being executed by, for example,the processing element 205. Thus, the databases, database instances,database management systems, data, applications, programs, programmodules, scripts, source code, object code, byte code, compiled code,interpreted code, machine code, executable instructions, and/or the likemay be used to control certain aspects of the operation of the graphconvolutional neural network computing entity 106 with the assistance ofthe processing element 205 and operating system.

As indicated, in one embodiment, the graph convolutional neural networkcomputing entity 106 may also include one or more communicationsinterfaces 220 for communicating with various computing entities, suchas by communicating data, content, information, and/or similar termsused herein interchangeably that can be transmitted, received, operatedon, processed, displayed, stored, and/or the like. Such communicationmay be executed using a wired data transmission protocol, such as fiberdistributed data interface (FDDI), digital subscriber line (DSL),Ethernet, asynchronous transfer mode (ATM), frame relay, data over cableservice interface specification (DOCSIS), or any other wiredtransmission protocol. Similarly, the graph convolutional neural networkcomputing entity 106 may be configured to communicate via wirelessexternal communication networks using any of a variety of protocols,such as general packet radio service (GPRS), Universal MobileTelecommunications System (UMTS), Code Division Multiple Access 2000(CDMA2000), CDMA2000 1× (1×RTT), Wideband Code Division Multiple Access(WCDMA), Global System for Mobile Communications (GSM), Enhanced Datarates for GSM Evolution (EDGE), Time Division-Synchronous Code DivisionMultiple Access (TD-SCDMA), Long Term Evolution (LTE), Evolved UniversalTerrestrial Radio Access Network (E-UTRAN), Evolution-Data Optimized(EVDO), High Speed Packet Access (HSPA), High-Speed Downlink PacketAccess (HSDPA), IEEE 802.11 (Wi-Fi), Wi-Fi Direct, 802.16 (WiMAX),ultra-wideband (UWB), infrared (IR) protocols, near field communication(NFC) protocols, Wibree, Bluetooth protocols, wireless universal serialbus (USB) protocols, and/or any other wireless protocol.

Although not shown, the graph convolutional neural network computingentity 106 may include or be in communication with one or more inputelements, such as a keyboard input, a mouse input, a touchscreen/display input, motion input, movement input, audio input,pointing device input, joystick input, keypad input, and/or the like.The graph convolutional neural network computing entity 106 may alsoinclude or be in communication with one or more output elements (notshown), such as audio output, video output, screen/display output,motion output, movement output, and/or the like.

Exemplary External Computing Entity

FIG. 3 provides an illustrative schematic representative of an externalcomputing entity 102 that can be used in conjunction with embodiments ofthe present invention. In general, the terms device, system, computingentity, entity, and/or similar words used herein interchangeably mayrefer to, for example, one or more computers, computing entities,desktops, mobile phones, tablets, phablets, notebooks, laptops,distributed systems, kiosks, input terminals, servers or servernetworks, blades, gateways, switches, processing devices, processingentities, set-top boxes, relays, routers, network access points, basestations, the like, and/or any combination of devices or entitiesadapted to perform the functions, operations, and/or processes describedherein. External computing entities 102 can be operated by variousparties. As shown in FIG. 3 , the external computing entity 102 caninclude an antenna 312, a transmitter 304 (e.g., radio), a receiver 306(e.g., radio), and a processing element 308 (e.g., CPLDs,microprocessors, multi-core processors, coprocessing entities, ASIPs,microcontrollers, and/or controllers) that provides signals to andreceives signals from the transmitter 304 and receiver 306,correspondingly.

The signals provided to and received from the transmitter 304 and thereceiver 306, correspondingly, may include signaling information/data inaccordance with air interface standards of applicable wireless systems.In this regard, the external computing entity 102 may be capable ofoperating with one or more air interface standards, communicationprotocols, modulation types, and access types. More particularly, theexternal computing entity 102 may operate in accordance with any of anumber of wireless communication standards and protocols, such as thosedescribed above with regard to the graph convolutional neural networkcomputing entity 106. In a particular embodiment, the external computingentity 102 may operate in accordance with multiple wirelesscommunication standards and protocols, such as UMTS, CDMA2000, 1×RTT,WCDMA, GSM, EDGE, TD-SCDMA, LTE, E-UTRAN, EVDO, HSPA, HSDPA, Wi-Fi,Wi-Fi Direct, WiMAX, UWB, IR, NFC, Bluetooth, USB, and/or the like.Similarly, the external computing entity 102 may operate in accordancewith multiple wired communication standards and protocols, such as thosedescribed above with regard to the graph convolutional neural networkcomputing entity 106 via a network interface 320.

The external computing entity 102 may also comprise a user interface(that can include a display 316 coupled to a processing element 308)and/or a user input interface (coupled to a processing element 308). Forexample, the user interface may be a user application, browser, userinterface, and/or similar words used herein interchangeably executing onand/or accessible via the external computing entity 102 to interact withand/or cause display of information/data from the graph convolutionalneural network computing entity 106, as described herein. The user inputinterface can comprise any of a number of devices or interfaces allowingthe external computing entity 102 to receive data, such as a keypad 318(hard or soft), a touch display, voice/speech or motion interfaces, orother input device. In embodiments including a keypad 318, the keypad318 can include (or cause display of) the conventional numeric (0-9) andrelated keys (#, *), and other keys used for operating the externalcomputing entity 102 and may include a full set of alphabetic keys orset of keys that may be activated to provide a full set of alphanumerickeys. In addition to providing input, the user input interface can beused, for example, to activate or deactivate certain functions, such asscreen savers and/or sleep modes.

The external computing entity 102 can also include volatile storage ormemory 322 and/or non-volatile storage or memory 324, which can beembedded and/or may be removable. For example, the non-volatile memorymay be ROM, PROM, EPROM, EEPROM, flash memory, MMCs, SD memory cards,Memory Sticks, CBRAM, PRAM, FeRAM, NVRAM, MRAM, RRAM, SONOS, FJG RAM,Millipede memory, racetrack memory, and/or the like. The volatile memorymay be RAM, DRAM, SRAM, FPM DRAM, EDO DRAM, SDRAM, DDR SDRAM, DDR2SDRAM, DDR3 SDRAM, RDRAM, TTRAM, T-RAM, Z-RAM, RIMM, DIMM, SIMM, VRAM,cache memory, register memory, and/or the like. The volatile andnon-volatile storage or memory can store databases, database instances,database management systems, data, applications, programs, programmodules, scripts, source code, object code, byte code, compiled code,interpreted code, machine code, executable instructions, and/or the liketo implement the functions of the external computing entity 102. Asindicated, this may include a user application that is resident on theentity or accessible through a browser or other user interface forcommunicating with the graph convolutional neural network computingentity 106 and/or various other computing entities.

In another embodiment, the external computing entity 102 may include oneor more components or functionality that are the same or similar tothose of the graph convolutional neural network computing entity 106, asdescribed in greater detail above. As will be recognized, thesearchitectures and descriptions are provided for exemplary purposes onlyand are not limiting to the various embodiments.

In various embodiments, the external computing entity 102 may beembodied as an artificial intelligence (AI) computing entity, such as anAmazon Echo, Amazon Echo Dot, Amazon Show, Google Home, and/or the like.Accordingly, the external computing entity 102 may be configured toprovide and/or receive information/data from a user via an input/outputmechanism, such as a display, a camera, a speaker, a voice-activatedinput, and/or the like. In certain embodiments, an AI computing entitymay comprise one or more predefined and executable program algorithmsstored within an onboard memory storage module, and/or accessible over anetwork. In various embodiments, the AI computing entity may beconfigured to retrieve and/or execute one or more of the predefinedprogram algorithms upon the occurrence of a predefined trigger event.

IV. EXEMPLARY SYSTEM OPERATIONS

To address the challenges associated related to performing real-time ornear-real-time anomaly detection using graph input data. According tosome aspects of the present invention, a graph convolutional model usedfor anomaly detection is retrained using confirmation feedback data inorder to enhance the real-time accuracy and dependability of the modelwithout requiring expensive re-design and re-training operations thatmay require taking the model offline. For example, in some embodiments,in response to determining to perform the anomaly confirmation withrespect to the predictive entity, a proposed system performs the anomalyconfirmation to generate the confirmation feedback data object for thepredictive entity, and integrates the confirmation feedback data objectfor the predictive entity into confirmation feedback data associatedwith a particular graph convolutional anomaly detection task. In someother embodiments, a proposed system monitors a confirmation feedbackstream to determine one or more feedback properties of a confirmationfeedback data object; determines, based at least in part on the one ormore feedback properties, a confirmation score for an anomaly detectionscore; determines, based at least in part on the confirmation score, aground-truth anomaly designation for a predictive entity; and trains agraph convolutional neural network model based at least in part on theground-truth anomaly designation.

By utilizing the above-noted techniques, various embodiments of thepresent invention provide innovative techniques for improving real-timeor near-real-time application of graph-based machine learning modelssuch as graph convolutional neural networks. Moreover, by improvingreal-time or near-real-time application of graph-based machine learningmodels such as graph convolutional neural networks, various embodimentsof the present invention provide innovative techniques for performingreal-time or near-real-time anomaly detection using graph input data. Indoing so, various embodiments of the present invention make importanttechnical contributions to efficiency, effectiveness, and reliability ofboth graph-based machine learning models such as graph convolutionalneural networks and anomaly detection systems such as fraud detectionsystems.

FIG. 4 is a flowchart diagram of an example process 400 for performinggraph convolutional anomaly detection. Via the various steps/operationsof process 400, the graph convolutional neural network computing entity106 can efficiently and effectively perform predictive inference usinggraph database input data and by utilizing a graph convolutional neuralnetwork model that is trained using a reliable and efficientconfirmation-based training routine. While various embodiments of thegraph convolutional predictive inference concepts discussed herein aredescribed with reference to anomaly detection (e.g., fraud detection), aperson of ordinary skill in the relevant technology will recognize thatthe disclosed techniques can also be utilized to perform othergraph-based predictive inference tasks in an effective and efficient.

The process 400 begins at step/operation 401 when the graphconvolutional neural network computing entity 106 identifies relatedgraph database input data associated with a predictive entity. In someembodiments, the related graph database input data include dataretrieved from one or more graph databases. A graph database is anydatabase that stores data as nodes (aka. vertices) and relationships(aka. edges) between the noted nodes. In some embodiments, a graphdatabase may further store node-related features andrelationship-related features. In some embodiments, a graph database maystore node-related features as relationships between primary nodes andfeature-describing nodes. In some embodiments, a graph database mayfurther enable storing relationships between relationships.

An operational example of a graph database 500 is presented in FIG. 5 .As depicted in FIG. 5 , the graph database 500 includes five nodes501-505 as well as six relationships 511-516: the relationship A 511between the node A 501 and the node B 502, the relationship B 512between the node A 501 and the node C 503, the relationship C 513between the node A 501 and the node D 504, the relationship D 514between the node B 502 and the node D 504, the relationship E 515between the node C 503 and the node E 505, and the relationship F 516between the node D 504 and the node E 505. Moreover, as further depictedin FIG. 5 , the graph database 500 includes node-related feature dataobject A 521 for the node A 501 and relationship-related feature dataobject A 531 for the relationship A 511.

Returning to FIG. 4 , in some embodiments, a graph convolutional neuralnetwork computing entity 106 may retrieve related graph database inputdata (e.g., node definition data, node-related feature data,relationship definition data, relationship-related feature data, etc.)from one or more graph databases. In some embodiments, the graphconvolutional neural network computing entity 106 may generate therelated graph database input data by retrieving non-graph database inputdata (e.g., relational database input data, object-oriented databaseinput data, non-relational database input data such as NoSQL databaseinput data and JSON database input data, etc.) from one or morenon-graph databases, detecting one or more graph database objects (e.g.,node graph database objects, relationship graph database objects,node-related feature graph database objects, relationship-related graphfeature database objects, etc.) among the non-graph database input data,and generating the related graph database input data based on at least asubset of the detected graph database objects.

In some embodiments, step/operation 401 may be performed in accordancewith the process described in FIG. 6 , which is a flowchart diagram ofan example process for generating graph database input data for apredictive entity. The process depicted in FIG. 6 begins atstep/operation 601 when the graph convolutional neural network computingentity 106 identifies a graph database including a plurality of graphdatabase objects. Examples of graph data objects include node graphdatabase objects, relationship graph database objects, node-relatedgraph database objects, relationship-related graph database objects,etc. In some embodiments, the graph convolutional neural networkcomputing entity 106 generates the graph database by detecting adesignated number of graph database objects (e.g., node graph databaseobjects, relationship graph database objects, node-related feature graphdatabase objects, relationship-related feature graph database objects,etc.) among particular non-graph database input data. In someembodiments, the number, ordering, and/or format of the detected graphdatabase objects is determined based on an input structure of a graphconvolutional neural network model described below with reference tostep/operation 403.

At step/operation 602, the graph convolutional neural network computingentity 106 selects a related subset of the plurality of graph databaseobjects identified in step/operation 601, where the graph databaseobjects in the related subset are deemed to be related to the predictiveentity. In some embodiments, a predictive entity refers to a data objectthat describes a real-world phenomenon about which a predictiveinference is performed. In some embodiments, a predictive entity maycorrespond to a collection of one or more graph database nodes and/orone or more graph database relationships.

For example, in a graph-based transactional record database that recordstransactions performed by particular IP addresses as relationshipsbetween transaction nodes and IP-address nodes, a predictive entity maycorrespond to a particular relationship between a correspondingtransaction node and a corresponding IP-address node, where theobjective of predictive inference may be to detect whether thetransaction described by the particular relationship is a fraudulenttransaction. As another example, in a graph-based transactional recorddatabase that records transactions performed by particular IP addressesas relationships between transaction nodes and IP-address nodes andtransactions performed at particular times between particular userprofiles as relationships between transaction nodes and user profilenodes, a predictive entity may correspond to a particular transactionnode and all its associated relationships include the relationshipbetween the corresponding transaction node and a correspondingIP-address node and the relationships between the correspondingtransaction node and any corresponding user profile nodes, where theobjective of predictive inference may be to detect whether thetransaction described by the particular relationships is a fraudulenttransaction.

An operational example of a graph database related subset 700 for aparticular predictive entity is depicted in FIG. 7 . As depicted in FIG.7 , the exemplary graph database related subset 700 includes nodes A-C501-502, node D 503, relationships A-C 511-513 (i.e., the relationship A511 between the node A 501 and the node B 502, the relationship B 512between the node A 501 and the node C 503, and the relationship C 513between the node A 501 and the node D 504), and feature objectsassociated with the noted nodes and relationships (i.e., node-relatedfeature data object A 521 for the node A and relationship-relatedfeature data object A 531 for the relationship A 511).

Returning to FIG. 6 , at step/operation 603, the graph convolutionalneural network computing entity 106 generates the related graph databaseinput data based at least in part on the related subset of the pluralityof graph database objects. In some embodiments, the graph convolutionalneural network computing entity 106 selects each graph database objectin the related subset of the plurality of graph database objects. Insome embodiments, the graph convolutional neural network computingentity 106 filters a reduced subset of graph database objects in therelated subset of the plurality of graph database objects based on inputstructure of a graph convolutional neural network model described withreference to step/operation 403.

In some embodiments, the graph convolutional neural network computingentity 106 generates a reduced subset of graph database objects in therelated subset of the plurality of graph database objects by performingone or more dimensionality reductions and/or feature embeddingoperations on the graph database objects in the related subset of theplurality of graph database objects in accordance with the inputstructure of a graph convolutional neural network model described withreference to step/operation 403. In some embodiments, the graphconvolutional neural network computing entity 106 generates a reducedsubset of graph database objects in the related subset of the pluralityof graph database objects by performing one or more dimensionalityreductions and/or feature embedding operations on the graph databaseobjects in the related subset of the plurality of graph database objectsin accordance with one or more trained parameters.

Returning to FIG. 4 , at step/operation 402, the graph convolutionalneural network computing entity 106 generates related graph feature datafor the predictive entity based on the related graph database input datafor the predictive entity. In some embodiments, the related graphfeature data includes a feature vector for each related graph databaseobject of one or more related graph database objects associated with thepredictive entity. In some embodiments, a feature vector is a datavector that includes feature data for a corresponding related graphdatabase object. Feature data of a related graph database object mayinclude features of the related graph database object retrieved from acorresponding graph database, features of the related graph databaseobject generated at runtime, and/or trained features of the relatedgraph database object. In some embodiments, the format of each vector isdetermined based on the input structure of a graph convolutional neuralnetwork model described with reference to step/operation 403.

In some embodiments, step/operation 402 may be performed in accordancewith the process depicted in FIG. 8 , which is a flowchart diagram of anexample process for generating a feature vector for a related graphdatabase object. The process depicted in FIG. 8 begins at step/operation801 when the graph convolutional neural network computing entity 106identifies one or more feature objects associated with the related graphdatabase objects. Feature objects of a related graph database object mayinclude feature objects of the related graph database object retrievedfrom a corresponding graph database, feature objects of the relatedgraph database object generated at runtime, and/or feature objects ofthe related graph database object determined based on one or moretrained parameter values and/or trained weight values associated withthe related graph database object.

At step/operation 802, the graph convolutional neural network computingentity 106 parses the feature objects to generate one or more parsedfeature objects. In some embodiments, the graph convolutional neuralnetwork computing entity 106 parses the feature objects using one ormore trained parsing parameters determined using a training algorithm.In some embodiments, the graph convolutional neural network computingentity 106 parses the feature objects in accordance with the inputstructure of a graph convolutional neural network model described withreference to step/operation 403.

At step/operation 803, the graph convolutional neural network computingentity 106 concatentates the one or more parsed feature objects into aconcatenated data object. In some embodiments, the graph convolutionalneural network computing entity 106 concatentates the one or more parsedfeature objects in accordance with a static concatenation order. In someembodiments, the graph convolutional neural network computing entity 106concatentates the one or more parsed feature objects in accordance witha dynamic concatenation order, e.g., a dynamic concatenation orderdetermined based on one or more trained concatenation parameters. Insome embodiments, the graph convolutional neural network computingentity 106 concatentates the one or more parsed feature objects inaccordance with the input structure of a graph convolutional neuralnetwork model described with reference to step/operation 403. Anoperational example of a concatenated data object 900 for the node A 501of the graph database 500 of FIG. 5 is depicted in FIG. 9 .

At step/operation 804, the graph convolutional neural network computingentity 106 processes the concatenated data object using a vectorizationmodel to generate the feature vector for the related graph databaseobject. In some embodiments, by utilizing concatenated data objects togenerate feature vectors which are then mapped using graph relationshipdata and/or graph structure definition data, the graph convolutionalneural network computing entity 106 can integrate both relationshipsbetween data and the contents of data into performing predictiveinference, thus enhancing the richness of the underlying data used toperform graph convolutional predictive inference, which in turnincreases efficiency and reliability of graph-based predictiveinferences.

Returning to FIG. 4 , at step/operation 403, the graph convolutionalneural network computing entity 106 generates an anomaly detection scorefor the predictive entity based on the related graph feature data andusing a graph convolutional neural network model. In some embodiments,an anomaly detection score indicates a predicted designation of acorresponding predictive entity as either anomalous or non-anomalous. Insome embodiments, an anomaly detection score indicates a predictedlikelihood that a corresponding predictive entity is either anomalous ornot anomalous. In some embodiments, at least a portion of the graphconvolutional neural network model is trained using confirmationfeedback data associated with the graph convolutional anomaly detection,as further described below. In some embodiments, the graph convolutionalneural network model may include one or more graph convolutional neuralnetworks, which is an example of a machine learning model configured toprocess input data including graph-based data and perform one or moregraph convolution operations on the underlying input data in order togenerate one or more prediction outputs. A graph convolution operationmay be any operation that, solely or in combination with one or moreoperations, reduces complexity of a graph-based input by applying someattention-based mechanism to the graph-based input.

An operational example of a graph convolutional neural network 1000 isdepicted in FIG. 10 . As depicted in FIG. 10 , the graph convolutionalneural network 1000 is configured to receive the graph-based input 1001,processes the graph-based input 1001 through a processing stage 1002that includes a number of successive graph-based convolutions followedby rectified linear unit activations to generate a convolutional feature1003, and processes the convolutional feature 1003 using a discriminantlayer 1004 to generate a prediction output 1005. In some embodiments,each combination of a graph convolution followed by a rectified linearunit activation performs the operations described by the below equation:

H←ReLU(H′θ),   Equation 1

where H is a convolutional feature generated by the combination, ReLUrefers to a rectified linear unit activation function, H′ is an input ofthe graph convolution, and θ describes convolution parameters used toperform graph convolution. In some embodiments, the structure of H′ andH is determined based on an input structure defined by θ. In someembodiments, H′ and H are a function of several variables includinghyper-parameters defined by θ.

In some embodiments, step/operation 403 can be performed in accordancewith the process depicted in FIG. 11 , which is a flowchart diagram ofan example process for generating the anomaly detection score for apredictive entity. The process depicted in FIG. 11 begins atstep/operation 1101 when the graph convolutional neural networkcomputing entity 106 processes each feature vector for a related graphdatabase object of the one or more related graph database objects usinga first graph convolutional neural network of the graph convolutionalneural network model to generate an anomaly presence likelihood for thepredictive entity and an anomaly absence likelihood for the predictiveentity. In some embodiments, the anomaly presence likelihood indicates alikelihood that the predictive entity is anomalous. In some embodiments,the anomaly absence likelihood indicates a likelihood that thepredictive entity is not anomalous.

At step/operation 1102, the graph convolutional neural network computingentity 106 determines the anomaly detection score based at least in parton the anomaly presence likelihood and the anomaly absence likelihood.In some embodiments, the graph convolutional neural network computingentity 106 determines an anomaly detection score indicating an anomalydetection if the anomaly presence likelihood outweighs the anomalyabsence likelihood. In some embodiments, the graph convolutional neuralnetwork computing entity 106 determines an anomaly detection scoreindicating an anomaly detection if the anomaly presence likelihoodoutweighs the anomaly absence likelihood by a threshold parameter, wherethe threshold parameter may be a static parameter, a dynamic parameter,or a trained parameter. In some embodiments, the related graph databaseinput data is associated with a first graph database of a plurality ofgraph databases from which the related graph database input data isretrieved, and the anomaly detection score is determined based at leastin part on the anomaly monitoring output of each graph database of theplurality of graph databases.

In some embodiments, step/operation 403 can be performed in accordancewith the process depicted in FIG. 12 , which is a data flow diagram ofan example process for generating the anomaly detection score for apredictive entity using a distributed database architecture. As depictedin FIG. 12 , a graph convolutional engine 1201 of the graphconvolutional neural network computing entity 106 receives first graphfeature data 1211 for a first graph database 1221 and second graphfeature data 1212 for a second graph database 1222. As further depictedin FIG. 12 , the graph convolutional engine 1201 processes the firstgraph feature data 1211 for the first graph database 1221 using a firstgraph convolutional neural network model 1231 to generate a firstanomaly monitoring output 1241. Furthermore, the graph convolutionalengine 1201 processes the second graph feature data 1212 for the secondgraph database 1222 using a second graph convolutional neural networkmodel 1232 to generate a second anomaly monitoring output 1242.Moreover, the graph convolutional engine 1201 utilizes an ensemble model1251 to generate the anomaly detection score 1261 for the predictiveentity based on combining both of the first anomaly monitoring output1241 and the second anomaly monitoring output 1242.

Returning to FIG. 4 , at step/operation 404, the graph convolutionalneural network computing entity 106 determines, based at least in parton the anomaly detection score, whether to perform anomaly confirmationwith respect to the predictive entity in order to generate aconfirmation feedback data object for the predictive entity. In someembodiments, anomaly confirmation is an automated and/or manual processfor determining whether a predictive entity is anomalous. In someembodiments, performing anomaly confirmation is deemed to beoperationally and/or computationally more costly than detecting anomalydetection scores. In some embodiments, by detecting anomaly detectionscores, the graph convolutional neural network computing entity 106 canprescreen potentially anomalous predictive entities to reduce the numberof predictive entities that require costly anomaly confirmations, thusincreasing operational and/or computational efficiency of anomalydetection systems. In some embodiments, an anomaly confirmation includesan automated and/or manual fraud investigation system. In someembodiments, the related graph database input data is retrieved from atransactional record database; and the anomaly detection score is afraudulent transaction detection score.

In response to determining to perform the anomaly confirmation withrespect to the predictive entity in order to generate the confirmationfeedback data object for the predictive entity, the graph convolutionalneural network computing entity 106 performs the anomaly confirmation togenerate the confirmation feedback data object for the predictive entityat step/operation 405 and integrates the confirmation feedback dataobject for the predictive entity into confirmation feedback dataassociated with the graph convolutional anomaly detection (e.g.,confirmation data used to train the graph convolutional neural networkmodel) at step/operation 406. In response to determining not to performthe anomaly confirmation, the graph convolutional neural networkcomputing entity 106 does not perform the anomaly confirmation atstep/operation 407. In some embodiments, integrating the confirmationfeedback data object for the predictive entity into confirmationfeedback data includes generating ground-truth training data based onthe result of the anomaly confirmation and using the ground-truthtraining data to re-train the graph convolutional neural network model.

In some embodiments, step/operation 406 can be performed in accordancewith the process depicted in FIG. 13 , which is a flowchart diagram ofan example process for training a graph convolutional neural networkusing feedback confirmation data. The process depicted in FIG. 13 beginsat step/operation 1301 when the graph convolutional neural networkcomputing entity 106 monitors a confirmation feedback stream todetermine one or more feedback properties of a feedback data object. Insome embodiments, a confirmation feedback stream is any data stream thatperiodically presents new feedback data objects. In some embodiments, afeedback property of a feedback data object is a data object thatdescribes a characteristic of the feedback data object, such as whetherthe feedback data object confirms a detection of anomaly risk (i.e., aconfirmation occurrence indicator) and how much delay exists between adetection of anomaly risk for a predictive entity and the confirmationof the noted detection (i.e., a confirmation latency indicator).

At step/operation 1302, the graph convolutional neural network computingentity 106 determines a confirmation score for an anomaly detectionscore associated with the feedback data object based on the feedbackproperties of the feedback data object. In some embodiments, theconfirmation score is a Boolean value that is set in accordance with theconfirmation occurrence indicator for the feedback data object. In someembodiments, the confirmation score is a continuous value that is set inaccordance with a group of feedback properties. In some embodiments, theconfirmation score is generated based on a confirmation score generationmachine learning model configured to apply trained parameters to thefeedback properties in order to generate the confirmation score for theanomaly detection score.

At step/operation 1303, the graph convolutional neural network computingentity 106 determines a ground-truth anomaly designation for thepredictive entity associated with the feedback data object based on theconfirmation score for the anomaly detection score. In some embodiments,a ground-truth data object is a value configured to be used as a targetoutput during training of the graph convolutional neural network model.In some embodiments, in response to determining that the confirmationscore falls below a threshold and/or indicates an incorrect anomalydetection score, the graph convolutional neural network computing entity106 determines a ground-truth anomaly designation and adds theground-truth anomaly designation to the training data for the graphconvolutional neural network. In some embodiments, the graphconvolutional neural network computing entity 106 determines aground-truth anomaly designation and adds the ground-truth anomalydesignation to the training data for the graph convolutional neuralnetwork regardless of the confirmation score for the anomaly detectionscore. Thus, in some embodiments, the graph convolutional neural networkcomputing entity 106 uses a constant feedback loop to update itstraining data based on anomaly confirmations, e.g., based on fraudinvestigation results.

At step/operation 1304, the graph convolutional neural network computingentity 106 trains the graph convolutional neural network model based onthe ground-truth anomaly designation. In some embodiments, the graphconvolutional neural network computing entity 106 trains the graphconvolutional neural network model based on the entirety of its trainingdata with the addition of the ground-truth anomaly designation. In someembodiments (e.g., when the graph convolutional neural network utilizesan online learning component), the graph convolutional neural networkcomputing entity 106 simply updates parameters of the pretrained graphconvolutional neural network model based on an error value determinedwith respect to an inferred value for the predictive entity and theground-truth anomaly designation determined based on the feedback dataobject. In some embodiments, the graph convolutional neural networkcomputing entity 106 trains the graph convolutional neural network modelusing an optimization-based training algorithm such as gradient descentor gradient descent with backpropagation.

Returning to FIG. 4 , at step/operation 408, the graph convolutionalneural network computing entity 106 performs one or more responsiveactions based on the anomaly detection score. In some embodiments, thegraph convolutional neural network computing entity 106 is configured toutilize a trained graph convolutional neural network model in order todetect various types of anomalies such as fraudulent activities. In someembodiments, upon detecting anomalies such as fraudulent activities, thegraph convolutional neural network computing entity 106 is configured toautomatically perform one or more responsive actions, such as automaticclosing of financial accounts, automatic notifications to accountholders, automatic audits of medical providers, etc. In someembodiments, the graph convolutional neural network computing entity 106is configured to provide a real-time fraud detection interface to one ormore administrative users. In some embodiments, the graph convolutionalneural network computing entity 106 is configured to automaticallyre-train one or more graph convolutional neural networks based onoutputs of anomaly confirmations such as fraud investigations. In someembodiments, the graph convolutional neural network computing entity 106is configured to automatically assign predicted anomaly detection casesto investigators based on factors such as investigator expertise,severity of predicted anomaly, recall rates of cases reviewed by theinvestigator, etc.

By utilizing the above-noted techniques, various embodiments of thepresent invention provide innovative techniques for improving real-timeor near-real-time application of graph-based machine learning modelssuch as graph convolutional neural networks. Moreover, by improvingreal-time or near-real-time application of graph-based machine learningmodels such as graph convolutional neural networks, various embodimentsof the present invention provide innovative techniques for performingreal-time or near-real-time anomaly detection using graph input data. Indoing so, various embodiments of the present invention make importanttechnical contributions to efficiency, effectiveness, and reliability ofboth graph-based machine learning models such as graph convolutionalneural networks and anomaly detection systems such as fraud detectionsystems.

V. CONCLUSION

Many modifications and other embodiments will come to mind to oneskilled in the art to which this disclosure pertains having the benefitof the teachings presented in the foregoing descriptions and theassociated drawings. Therefore, it is to be understood that thedisclosure is not to be limited to the specific embodiments disclosedand that modifications and other embodiments are intended to be includedwithin the scope of the appended claims. Although specific terms areemployed herein, they are used in a generic and descriptive sense onlyand not for purposes of limitation.

1. A computer-implemented method for performing graph convolutionalanomaly detection, the computer-implemented method comprising:generating, based at least in part on related graph database input data,related graph feature data for a predictive entity, wherein the relatedgraph feature data comprises a feature vector for each related graphdatabase object of one or more related graph database objects associatedwith the predictive entity; generating, based at least in part on therelated graph feature data and using a graph convolutional neuralnetwork model, an anomaly detection score for the predictive entity,wherein at least a portion of the graph convolutional neural networkmodel is trained using confirmation feedback data associated with thegraph convolutional anomaly detection; responsive to a determination toperform an anomaly confirmation with respect to the predictive entity:performing the anomaly confirmation to generate the confirmationfeedback data object for the predictive entity, and integrating theconfirmation feedback data object for the predictive entity into theconfirmation feedback data associated with the graph convolutionalanomaly detection; and performing one or more responsive actions basedat least in part on the anomaly detection score.
 2. Thecomputer-implemented method of claim 1, wherein identifying the graphdatabase input data comprises: identifying a graph database, wherein thegraph database comprises a plurality of graph database objects;selecting a related subset of the plurality of graph database objectsthat are deemed to be related to the predictive entity; and generatingthe related graph database input data based at least in part on therelated subset.
 3. The computer-implemented method of claim 1, whereingenerating the related graph feature data comprises: for each relatedgraph database object of the one or more related graph database objects,identifying one or more feature objects associated with the relatedgraph database object, parsing the one or more feature objects togenerate one or more parsed feature objects, concatenating the one ormore parsed feature objects into a concatenated data object, andprocessing the concatenated data object using a vectorization model togenerate the feature vector for the related graph database object. 4.The computer-implemented method of claim 1, wherein generating theanomaly detection likelihood comprises: processing each feature vectorfor a related graph database object of the one or more related graphdatabase objects using a first graph convolutional neural network of thegraph convolutional neural network model to generate an anomaly presencelikelihood for the predictive entity and an anomaly absence likelihoodfor the predictive entity; and determining the anomaly detection scorebased at least in part on the anomaly presence likelihood and theanomaly absence likelihood.
 5. The computer-implemented method of claim1, wherein: the related graph database input data is associated with afirst graph database of a plurality of graph databases from which therelated graph database input data is retrieved, and the anomalydetection score is determined based at least in part on the anomalymonitoring output of each graph database of the plurality of graphdatabases.
 6. The computer-implemented method of claim 1, whereinintegrating the confirmation feedback data object for the predictiveentity into the confirmation feedback data associated with the graphconvolutional anomaly detection comprises: monitoring a confirmationfeedback stream to determine one or more feedback properties of thefeedback data object; determining, based at least in part on the one ormore feedback properties, a confirmation score for the anomaly detectionscore; determinizing, based at least in part on the confirmation score,a ground-truth anomaly designation for the predictive entity; andtraining the graph convolutional neural network model based at least inpart on the ground-truth anomaly designation.
 7. Thecomputer-implemented method of claim 1, wherein the ground-truth anomalydesignation is assigned a convolutional score based at least in part onthe confirmation score.
 8. The computer-implemented method of claim 1,wherein the one or more feedback properties comprise a confirmationoccurrence indicator and a confirmation latency indicator.
 9. Thecomputer-implemented method of claim 1, wherein: the related graphdatabase input data is retrieved from a transactional record database;and the anomaly detection score is a fraudulent transaction detectionscore.
 10. The computer-implemented method of claim 1, wherein thefeature structure of the related graph feature data is determined basedat least in part on an input structure of the graph convolutional neuralnetwork model.
 11. An apparatus for performing graph convolutionalanomaly detection, the apparatus comprising at least one processor andat least one memory including program code, the at least one memory andthe program code configured to, with the processor, cause the apparatusto at least: generate, based at least in part on related graph databaseinput data, related graph feature data for a predictive entity, whereinthe related graph feature data comprises a feature vector for eachrelated graph database object of one or more related graph databaseobjects associated with the predictive entity; generate, based at leastin part on the related graph feature data and using a graphconvolutional neural network model, an anomaly detection score for thepredictive entity, wherein at least a portion of the graph convolutionalneural network model is trained using confirmation feedback dataassociated with the graph convolutional anomaly detection; responsive toa determination to perform an anomaly confirmation with respect to thepredictive entity: perform the anomaly confirmation to generate theconfirmation feedback data object for the predictive entity, andintegrate the confirmation feedback data object for the predictiveentity into the confirmation feedback data associated with the graphconvolutional anomaly detection; and perform one or more responsiveactions based at least in part on the anomaly detection score.
 12. Theapparatus of claim 11, wherein identifying the graph database input datacomprises: identifying a graph database, wherein the graph databasecomprises a plurality of graph database objects; selecting a relatedsubset of the plurality of graph database objects that are deemed to berelated to the predictive entity; and generating the related graphdatabase input data based at least in part on the related subset. 13.The apparatus of claim 11, wherein generating the related graph featuredata comprises: for each related graph database object of the one ormore related graph database objects, identifying one or more featureobjects associated with the related graph database object, parsing theone or more feature objects to generate one or more parsed featureobjects, concatenating the one or more parsed feature objects into aconcatenated data object, and processing the concatenated data objectusing a vectorization model to generate the feature vector for therelated graph database object.
 14. The apparatus of claim 11, whereingenerating the anomaly detection likelihood comprises: processing eachfeature vector for a related graph database object of the one or morerelated graph database objects using a first graph convolutional neuralnetwork of the graph convolutional neural network model to generate ananomaly presence likelihood for the predictive entity and an anomalyabsence likelihood for the predictive entity; and determining theanomaly detection score based at least in part on the anomaly presencelikelihood and the anomaly absence likelihood.
 15. The apparatus ofclaim 11, wherein: the related graph database input data is associatedwith a first graph database of a plurality of graph databases from whichthe related graph database input data is retrieved, and the anomalydetection score is determined based at least in part on the anomalymonitoring output of each graph database of the plurality of graphdatabases.
 16. The apparatus of claim 11, wherein integrating theconfirmation feedback data object for the predictive entity into theconfirmation feedback data associated with the graph convolutionalanomaly detection comprises: monitoring a confirmation feedback streamto determine one or more feedback properties of the feedback dataobject; determining, based at least in part on the one or more feedbackproperties, a confirmation score for the anomaly detection score;determinizing, based at least in part on the confirmation score, aground-truth anomaly designation for the predictive entity; and trainingthe graph convolutional.
 17. The apparatus of claim 11, wherein the oneor more feedback properties comprise a confirmation occurrence indicatorand a confirmation latency indicator.
 18. The apparatus of claim 11,wherein: the related graph database input data is retrieved from atransactional record database; and the anomaly detection score is afraudulent transaction detection score.
 19. The apparatus of claim 11,wherein the feature structure of the related graph feature data isdetermined based at least in part on an input structure of the graphconvolutional neural network model.
 20. A computer program product forperforming graph convolutional anomaly detection, the computer programproduct comprising at least one non-transitory computer-readable storagemedium having computer-readable program code portions stored therein,the computer-readable program code portions configured to: generate,based at least in part on related graph database input data, relatedgraph feature data for a predictive entity, wherein the related graphfeature data comprises a feature vector for each related graph databaseobject of one or more related graph database objects associated with thepredictive entity; generate, based at least in part on the related graphfeature data and using a graph convolutional neural network model, ananomaly detection score for the predictive entity, wherein at least aportion of the graph convolutional neural network model is trained usingconfirmation feedback data associated with the graph convolutionalanomaly detection; responsive to a determination to perform an anomalyconfirmation with respect to the predictive entity: perform the anomalyconfirmation to generate the confirmation feedback data object for thepredictive entity, and integrate the confirmation feedback data objectfor the predictive entity into the confirmation feedback data associatedwith the graph convolutional anomaly detection; and perform one or moreresponsive actions based at least in part on the anomaly detectionscore.